Epsilon worries it may lose business after major data breach

Robert McMillan |
April 6, 2011

Alliance Data says that the breach will have a minimal impact on its quarterly earnings.

SAN FRANCISCO, 6 APRIL 2011 - The company responsible for one of the most publicized data breaches this year fears it may now lose some business but says that it continues to pump out marketing email as usual.

Epsilon Interactive's parent company, Alliance Data, apologized Wednesday for a data breach that has left millions of customers of some of the largest U.S. companies wondering if they may soon be the target of spam or phishing attacks.

Alliance Data said the incident -- now under investigation by federal authorities -- will have a minimal effect on its bottom line but worried about the possible impact on its business.

"The company believes the greatest risk to Epsilon and Alliance Data is the potential loss of valued clients," Alliance Data said in a statement, but it "expects this incident to have minimal if any impact on Alliance Data's financial performance."

Alliance Data is one of the country's largest marketing data firms. Recently, someone broke into its subsidiary's computer systems and downloaded customer names and e-mail addresses belonging to nearly 60 Epsilon customers, who use the marketing company to send email messages to customers. Although the affected customers represented just 2 percent of Epsilon's 2,500 clients, they amount to a who's who of U.S. business.

Companies such as Citibank, Verizon, Marriott and Walgreens have sent out millions of notification emails this week, warning customers that their email addresses have been stolen, and telling them to be on the lookout for phishing messages or spam. Many consumers say they received several of these notification messages.

Security experts say that knowing people's names, email addresses and the companies they do business with makes it easier for scammers to craft believable "spear-phishing" messages. They worry that the breach could lead to a rash of spam or targeted phishing attacks.

Neither Epsilon nor Alliance Data will say how many customers are being notified, but they say that only customer names and email addresses -- not social security numbers or account information -- were stolen.

"We fully recognize the impact this has had on our clients and their customers, and on behalf of the entire Alliance Data organization, we sincerely apologize," Alliance Data said in its statement Wednesday. "We will leave no stone unturned and are dealing with this malicious act by highly sophisticated cyber-thieves with the greatest sense of urgency."

Alliance Data says that the 40 billion email messages that Epsilon sends out each year continue to be pumped out. "Epsilon's email volumes are not expected to be significantly impacted," the company said.

One client that's been caught up in the breach, Verizon, wouldn't say whether it plans to continue to do business with the email service provider. "We are continually reviewing our agreements with vendors and contractors and making whatever changes are in the best interest of our business," said Verizon spokesman Clifford Lee, when asked if Verizon plans to continue to employ Epsilon.